Privacy Limitations and Final Verdict

BBC Sounds, Music, Radio Podcasts Hi, I'm Xing Singh, and I'm Simon Jack, and together we host Good Bad Billionaire, the podcast exploring how some of the world's richest people made their fortunes . And we're back for a new season with a brand new lineup of billionaires. Yeah, global pop icon Beyonce. Hollywood movie director Steven Spielberg. Football superstar Christiana Renalo, anyone? And as ever, we're asking you to decide whether they're good, bad or just another billionaire. That's good, bad, billionaire. Listen first on BBC Sounds. Hello, I'm Greg Foot and welcome to Slice Bread, the show that investig ates the Wonder Products promising to make you happier, healthier, or greener. Each episode, we follow the crumbs of evidence to find out if one of your suggested Wonder Products is indeed the best thing since Sliced Bread or Marketing BS BS and today's suggestion comes from Andrew who is in Lincolnshire. Hello, Andrew. Hello, Greg. What wonder product would you like us to investigate today? I would like you to investigate VPN's VPN's on your computer. Virtual private network, it stands for. I'm sure you knew that. I did. Yes. I'd see adverts for it saying I need this the security . Now I thought I had security on my items anyway with Windows Deenderf and Nord Antivirus. This seems to be something that I need to make me secure. Right, well we will find out there are countless VPN providers. We've heard of Nord VPN, ExpressVPN, Norton VPN , Surfshark, IPVanish, there's a long list. As you say, Andrew, the claim does appear to be all about the security that a VPN can offer you. What other benefits have you seen listed? This count ing from ten to thirty two benefits depending on what level you go for. Yes, the level. I understand it also reduces the number of adverts , the potential for identity theft , phishing attacks, different level of security compared to that which I believe I have already. Andrew, this isn't a loaded question, but is there anything you're doing on the internet that you'd prefer people didn't know you were doing? As far as I'm aware, no , if I am out and about, I'm careful of where I sign into networks . So if I'm out in a pub or staying in a hotel or on a holiday, I can see this potentially being advantageous. Well, we've had an influx of VPN related requests, perhaps thanks to the new regulations that came into force as part of the online safety act last year, something I would like to discuss in a bit. Let me read you two of the emails that were sent to sliced. BBC. co . Listener Julie wrote I keep getting adverts with VPNs but I'm not clear on what their benefits are other than tricking a streaming service into thinking you're somewhere else. And here is one from listener Tom who wrot,e , Is a VPN hiding your web traffic from your ISP but giving it instead to the VPN company? And can't the VPN company then choose to do something bad with it, whether that's selling it to advertisers or something worse . Right, well I'm really looking forward to this one. Let me connect you with the expert that's here in the studio . Yes, I'm not getting a very strong signal from that pun, Andrew. Okay, that's better. Yeah, yeah. Good. I thought I was going to have to serve you up a better one, but glad you'd like that. I can't stop. I can't stop. I'm stopping, I'm stopping. In the studio with me is cybersecurity expert and fellow of the Chartered Institute of IT, Professor Victoria Baines. Hi, Greg. Thrilled to be here. Well, the first question is what is a virtual private network ? Well, what a virtual private network does is it encrypts your data in transit, so all of your communications going from your dev ices to wherever they're going , scrambling it so that it can't be read until it gets to its destination . And many VPN's offer a thing called a tunnel. They say we tunnel your communications . So say you want to visit a website, that request would go to your internet service provider the ISP. The ISP I or BT or Virgin, etc . Exactly. And then it goes to the VPN 's processes . And that means that when you land on a website or an app , what you actually register is the VPN's address, so their address on the internet. IP address IP address. So it's masking your IP address. So it's basically masking your location, to a certain extent, the identity of your device . It's not really a tunnel in the way that we might envisage it. Maybe the better metaphor is a smokescreen. Right. So a VPN can change your visible IP address to a private IP address so that that information about where you are or who you are is no longer visible. That's it. And the flip side of that, of course, is that your internet service provider also can't see your browsing history, so they can't see which websites you're landing on. Andrew, is this making sense? It is making sense. Okay, so as we heard earlier, one place they say that VPN can protect you is when you're using a public W Fi hotspot in a cafe or an airport or whverate. How could a VPN be helpful there, Vic ? OK, so there's a thing called a man in the middle attack and as the name suggests that's where somebody just intercepts your communications with public i Wi F, particularly where it's not very secure, where there's a password on the wall, you know, in a coffee shop or in a hotel for instance , it's a lot easier for somebody to just get into that WiFi and just read everybody's traffic. Because you're on the same network as them, they have access to see what you're doing. That's it. So they can just sit there and catch people's communications. Now, man in the Middle Attacks were really successful when we didn't have other security measures . So in the last ten to fifteen years, we've seen browsers actually securing websites. So if you have been looking at a website and you see a little p adlock in the address bar . That's a thing called HTTPS stands for hyper text transfer protocol secure. And what that means is that the traffic between your web browser and the website is encrypted. That scrambles your information, all of those packets of information that are going across the internet from your device to the destination, website or app. And it just makes it un readable if somebody intercepts that. So even if you are on an open network, then if your browser is encrypting that traffic and you see that locked padlock , someone who's doing this man in the middle attack won't be able to see where you're accessing. That's absolutely right. Now also if you're using an app like WhatsApp or signal or iMessage on an Apple phone , that is also end to end encrypted. So there are many other ways in which we can achieve encryption. A VPN is not the only way to encrypt your internet traffic. Okay, so the thing here is that there is encryption on the internet and in some of these apps that we're using , and if that is in place you don't need a VPN for that encryption . We always say in cybersecurity it does no harm to have too many security measures in place, potentially layer in your armour . Generally speaking, I don't think I'm too worried about what I'm handing over in terms of information other than passwords and financial detail s. But certainly if I was in a hotel and suddenly realized I needed to purchase something within a given timescale, I would be concerned about security so that or something like the VPN sounds as though it would be useful to me. Okay, onto the second scenario that the marketing sometimes mentions that using a VPN is useful for is when you're traveling , they say that changing your IP address means that you can be in any country and you can make it look like you're still at home or on the flip side , you can be at home and make it look like you're anywhere in the world. Why might that be helpful, Vic? OK, there are legitimate users, but let's start with a slightly more normal one. In the UK, we have some streaming services that are international and some that have nationally restricted in the sense of if I want to access iPlayer or BBC sounds even, I need to be in the UK at the time in order to be able to watch and download material. You might be in the middle of a series that you're watching, you'll be travelling for work, or you'll be on holiday and you'll think I need to catch up with Traders, latest episode of Traders, of course . And you suddenly find that you can't do that . Because you're no longer coming from a UK Internet protocol, IP address, basically, the server that you're on is saying, sorry, you're not in the UK anymore. Vic, what is a server? A server is just a computer. And in this case what we're looking at is a computer that is processing other people's requests to access websites and services. So a VPN you can, use one of those to masquerade as coming from the UK. You can say, right, I will choose a UK server and then it looks like I'm coming from the UK . Is that legal? Not entirely no, because you're basically breaking the terms of service, but this is one of those areas where the internet has challenged some of our generally held conceptions about what it's okay to do and what it 's not okay to do in the same way that listening to songs that we haven't paid for was quite a problem a few years ago with streaming services. Tech does tend to challenge notions of what is legal and what isn't? Well, looking at what the brands themselves say about this. NordVPN write, quote, VPN's are legal in most countries around the world, including the UK, as long as you don't do anything illegal whilst using one. ExpressVPN say quote VPN's are legal in most countries and are commonly used by individuals and businesses to protect privacy and secure online activity. Keep in mind, using a VPN doesn't make illegal activities legal. Regarding streaming services, ProtonVPN have an interesting claim here. They say quote, We don't block Netflix or any other streaming service on our free servers, but we only guarantee access to streaming services if you're on a paid plan . And that's really interesting because I can't see precisely how they can guarantee that you can have access to that service even if you're not in the intended or the correct country of service . Because one of the things I do know is that streaming services keep lists of those VPN servers and will block access coming from what are identified as servers for VPN's. So you can identify who's coming from NordVPN, who's coming from protonVPN until they open up another server . Right. Cat and mouse. Absolutely. It's an expensive business running a VPN because if you've got to have that much server space, some VPN's say that they have hundreds, thousands of servers that they're servicing hundreds of thousands, millions of users . So they need to be able to have quite a huge resource there. We've always really like to give listeners a sense of the range of the cost of the Wonder product that we're investigating on the show. It's very tricky to do that with VPNs because as you mentioned Andrew, there are different levels of service. The price depends on the provider, the level of service you go for, and how long you subscribe for because it looks like the first two years tend to be heavily discounted. So actually Vic, if you're trying to find the cheapest approach, is it to sign up to something for two years, leave, sign up to a different provider for two years, make the most of that discount. You know, far be it for me to be Martin Lewis on this but he would it would be quite a canny thing to do, I say here is my best attempt at comparing the costs, right? The most expensive one that we saw was NordVPN premium, which after that two in a bit years offer, which is around five pounds a month, it's then eighteen pounds fifty nine pence a month. Coming in a little cheaper than that are the premium products from ExpressVPN and Surfshark, both around fifteen pounds a month . Most VPN providers also offer a basic version, which is cheaper. So Surfshark's starter is just one pound fifty a month for two in a bit years and then eleven forty nine a month from then. But several brands basics offerings come out around about a five for a month. So there's a whole range here. And Vick, I want to get into the specifics in a minute. In general, is it worth paying more? The more you pay, the more features you get, but it depends very much on what features you've identified you actually need. Yeah, absolutely. I should also add there are plenty of VPN services that are free , but all the free ones that we looked at tend to use a freemium model where you get certain features for free , then you have to upgrade to get additional features. For example, Bitdefender's free VPN is limited to five hundred megabytes of data a day, which they say themselves is insufficient for streaming. Their paid model on the other, , has unlimited data. So you can see the attraction. One clear point of comparison between these different VPN providers is the number of servers that they use. Andrew, have you seen this? I have, yes. I think NorVPN was saying they had something like eight thousand across, I think it was one hundred and ten plus countries . I'm sure I don't need that many . So it does seem that the more you pay, the more servers you apparently get access to. But Vic, is it a case that the more servers the better? Generally speaking, yes, because if we use the analogy of everybody's home broadband connection, if you've got a family of four or five and you've got three of them are gamers and one of them streaming, you'll find that stuff slows down. So imagine the world and everybody wanting to use these servers. The more servers you have, the more space . So the higher the speed and what we call the lower the latency. You haven't got that lag it's not dropping out. I should say that the free versions do tend to have far fewer servers. So ProtonVP N's free version says you can connect to servers in ten countries and the server will be randomly selected, interestingly. Planet VPN's free version restricts you to just eleven servers. It sounds as though if you have a high amount of data you want to transfer, I'd imagine if you're gaming or something like that, then it's very useful to have that number of servants and the high speeds. Yeah, protonVPNs say that a benefit of making it look like you're in a different location could include while gaming to unlock games and maps and skins and other add ons that might be restricted on your network. They also say while shopping to find the best deals in the world no matter where you're shopping from. That is the first I'd heard of that. Could I save money using a VPN? Well, we've all heard about those scandals around dynamic pricing for concert tickets and things like that. And it is unfortunate ly a recognized business model. If users are going on a retail website where the price is variable , they can check at one time. And then if they revisit that website, the price might have suddenly gone up, for instance, flight s, holidays, etc . And so if you're switching country and coming in from a different IP address in a different jurisdiction , the theory goes that you should be able to access different pricing. Now that can happen , but it can also make your life a little bit more complicated if suddenly you're only seeing prices in euros or dollars and that you can't log into your account anysmore because your account will say, 'Oh, sorry, this is only a UK account, etc , etc. ' It's a lot of admin, isn't it? It's a lot of work. Going back to the main use case, which is using a VPN to protect your privacy online. You introduced us earlier to this encrypted tunnel that the VPN sets up between your computer and the VPN server to mask your IP address . Some VPN's make extra claims about the level or the type of encryption they offer. NordVPN offer double VPN service to encrypt your connection twice if you want extra privacy. Should we be looking out for even better encryption? In most cases there is enough encryption on many of the ser vices that we already use. And I think it's worth mentioning that encryption is actually quite controversial . So listeners will have heard in the media that there's been a lot of concern by safety advocates , by members of various governments about Facebook encrypting messenger chats. Because the idea is that if something is encrypted end to end from the person who sent it to the person who has received it , then law enforcement, the government, the intelligence agencies can't make sense of that traffic. They may be able to intercept it, but it's still scrambled. And you can see how that's a frustration for govern ment authorities where they need to be able to find missing children or prevent terrorist attacks. So I suppose the conversation here is around need for privacy and encryption for individual versus state or government access . And a VPN looks to offer blanket encryption across everything rather than just in the specific apps like WhatsApp or Facebook Messenger. And that's one of the troubles that we have with encryption is that it 's either on or it's off. You don't have exceptions . It's worth mentioning that there are several countries that have actually banned access to VPNs because they are perceived to be facilitating access to information that their citizens shouldn't have access to. Because they're seen as a workaround of censorship , known VPN destinations will be blocked for a lot of internet users in several countries . And some websites say government services not allow you to log on to them using a VPN because it's seen that you're deliberately anonym izing your appearance on the internet and therefore you might have shady motives for doing so. NordVPN also described theirs as post quantum encryption . Oh goodness. Well, I think you need to do another edition of this program about quantum computing. Oh, I mean, that'd be fascinating. We'll be both here and not here. Exactly . But if a quantum computer cracks our current encryption algorithms , cyber criminals who could then be able to read all of our private data. So they're capturing the encrypted scrambled communications that at the moment make no sense, but maybe in the future might. Absolutely. And you know, Big Tech is legitimately concerned about this . The problem is that quantum computing is not yet at the stage where this can happen and it's really difficult to put a date on when that might actually happen. I can see therefore why VNORDVPN say, you know, they have post quantum encryption , but surely you wouldn't know how to encrypt right now against something that is quantum. One of the things that is branded as post quantum is using quantum computing to develop new encryption protocols. I think my brain's just exploded.. Yeah Those of us who work in tech, we got very, very bored of people using AI powered in front of everything and quantum is becoming that new buzzword What sort of features should I be looking for and what are required to give me proper protection? There's all sorts of things they're offering, so email scam checkers, AI powder detection, phishing attack detection , credit card legal alert . All these features , Vic, Andrew List there, are additional services that you can add on to your VPN package and you pay more if you want more. As part of NordVPN's premium package, they offer threat protection pro , which they say will block third party trackers from following you around the internet and provide invisible protection from malware. Others say similar, Surfshark says you can quote experience the web before advertising happened. Free of ads, cookies, popups, and trackers. They also offer antivirus protection that shields your device from malware, but also blocks access to your camera from all unauthorized apps. The pure VPN that you've described to us already Vic , does that protect you from malware and scams? Does it protect you from ads and popups? A VPN by itself doesn't do any of those things , and equally , lots of the other technologies that we have available to us, like our browsers , like our spam folders on our web based email, all of our hot mail and gmail, already check for those things. And that means all of the services that you land on that you actually use, even when you're using the VPN will still be collecting data about you . And unless you have specific security measures to block cookies and third party tracking , then that will still be possible from those services . Right. So websites can't see where you are coming from as they can't see that Andrew is in Lincolnshire, but they could see potentially some of your internet journey that you've been on in this session and they could still build up this digital footprint. And then when you come back to that same website again in the future they go, Aha, I think that could be that same person from that hidden IP address and they build up more of that fingerprint. That's right. Right. So a VPN may hide where you're connecting from, but it does not stop you being tracked around the internet or protect you from ads or protected from viruses or malware . Those are all the products that are being added on to VPN's by some of these companies that are wanting to sell it more as a security package. And do you remember a few years ago , certainly ten, fifteen years ago, we were all encouraged to buy antivirus software . Now that antivirus software is mostly within your operating system . So as long as you're keeping your operating up to date and downloading those updates that are very, very irritating and take time. You don't actually need additional antivirus software anymore. If Window Defender is doing the job, why do I need all the extras with the BBNs? I think there are also additional considerations around all of our privacy as users. So if we think about some of the other features like Andrew mentioned a credit card leak alert, what that means is you would need to supply your credit card information for the VPN provider to then run that through the web to find if it had been leaked anywhere. This brings us brilliantly to the question that listener Tom asked in his email . He said the VPN could be hiding your web traffic, your credit card details from your ISP, your internet service provider. But that data is still going to the VPN server. So the concern there is, could the VPN company take that data and sell it to advertisers ? They absolutely shouldn't , but with particularly some of the companies that are offering free services, they've got to make their money somehow. They've got to pay for all of those servers somehow. So there has to be some kind of monetization model. And that's why it's really, really careful to check the small print of any service that you're signing up for. Okay , before my final question, I mentioned earlier the online safety act . So last year on the twenty fifth of july twenty twenty five, a piece of legislation came into force in the UK , and I'm going to quote here from OffCom, who say that the legislation now requires, quote, all sites and apps that allow pornography to have strong age checks in place to make sure children can't access that or other harmful content . In the week after the legislation came into force, it was reported that VPN sign up spiked. ProtonVPN, for example, they said they saw a one thousand eight hundred percent rise in sign ups. So Vic, are people using VPNs to get around this age verification ? Well, one of the things we were concerned about was that these were children who were trying to work around the age verification checks in order to continue to access pornography . But actually what appears to have spiked is adult usage that people who could previously view pornography on a website without having to register , without having to prove their age are now concerned about having to do that because how can you prove your identity , possibly with a credit card, possibly with your government issued ID, like a passport or a dri ving license and possibly also having to match that with facial recognition. For a lot of people, that's just too much of an invasion of privacy. Right, well, let's try to bring all of this together with the final question, Vic , are VPNs that promise to keep you safe, secure, private online? Are they the best thing since slice bread? Are they SB or are they marketing BS ? Well, it depends on who you are and what you're using the internet for. VPN's, pure VPNs , do one thing very well, but they are no substitute for good, basic cyber security, for instance , having ungessable, strong passwords that you change frequently, learning how to spot phishing attacks and scams and making sure that your software is up to date. So Andrew, it depends on who you are and what you're doing on the internet. Do you feel that what you are doing on the internet requires a VPN ? I don't. For my personal use , I could see there might be advantages if you're doing a lot of streaming though. What about? You did say that you sometimes work in a cafe or you might want to connect to the Wi Fi in a hotel . For the number of occasions that I would use it, maybe I just restrict how I use it and what information I put in when using it . One of the things we're seeing more and more is that actually we've all got five G. Our data plans are getting much, much cheaper . So I think there's less call in some ways to have cafe wifi, hotel wifi. I think it's all about the other security measures that we can put in place first. There will always be some people. I'm one of them that feel they need to use a VPN because they need additional security , but it's not going to be for everybody . Do I need a VPN? What would you ask me? What would be the two ? I would ask you some really really, intrusive questions that I don't really want to know the answer to. And that's the end of the episode . Well, with that, I shall wrap up this episode of Sliced Bread and thank you to Andrew and V ic for joining me. And if you are listening to this and thinking, Greg, I have a wonder product I would really like you to investigate, please do send it over either on email to Sliced Bread at bBC. co or as a message or a voice note on WhatsApp two zero seven five forty three six eight seven Next time we're finally able to slice our bread because we're talking about kitchen knives and knife sharpeners. Should you be paying good money for a Japanese knife made of Damascus steel, and can any of the home sharpeners you can buy actually restore them to their former glory? I'll be finding out. See ya . This episode of Sliced Bread was researched by Phil Sansom and produced by Simon Hoban and me, Greg Foot. Our studio manager was Amy Brennan and Slice Bread is an audio north production for BBC Radio four . How does someone invent a political theory